Using audit as extended inotify
Steve Grubb
sgrubb at redhat.com
Tue Jul 28 19:30:02 UTC 2015
On Monday, July 27, 2015 07:30:33 PM Tyler Hardin wrote:
> I want to monitor file and directory creation, modification, and deletion
> on some large subtrees (/etc/, /usr/share/, and ~/.config/). And I want the
> name of the executable that caused the event. The purpose will be to
> facilitate cruft detection and removal.
You cannot use globbing in the path.
> Can audit do this? Will using it to do this with such large subtrees become
> a performance issue?
It sort of can. You can monitor directory creation, file creation, and
deletion. Modification is where you start to have an issue. What you can see is
the file is opened with a write flag. But you have no idea if it actually
changed the file. You should be able to see the process doing it. But, I think
you might get a lot of records to process. Give it a try.
-Steve
More information about the Linux-audit
mailing list